Description

MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Remediation

References

CVE-2014-8775

Related Vulnerabilities

Drupal Core 9.4.x Cross-Site Scripting (9.4.0 - 9.4.2)

WordPress Plugin Super Interactive Maps for WordPress Arbitrary File Upload (1.9)

WordPress Plugin Leaflet Maps Marker Pro Multiple Vulnerabilities (1.5.7)

Joomla Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-35615)

Ruby Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2020-25613)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2014-8775